Description

A stack-based buffer overflow vulnerability exists in BlueZ, the Linux Bluetooth protocol stack. A remote user within Bluetooth radio range can send a specially crafted Extended Inquiry Response (EIR) packet that causes a buffer overflow when the target device performs Bluetooth discovery. This vulnerability can lead to a Denial of Service (DoS) by crashing the bluetoothd service and may allow for arbitrary code execution.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.6",
  "pubDate": "2026-08-25T22:17:07.587Z",
  "pubdate": "2026-08-25T22:17:07.587Z",
  "executiveSummary": "A critical stack-based buffer overflow vulnerability has been identified in BlueZ, the official Linux Bluetooth protocol stack. The vulnerability resides in the processing of Extended Inquiry Response (EIR) packets during the device discovery process. An attacker located within the proximity of the target device’s Bluetooth radio range can transmit a maliciously crafted EIR packet to trigger the overflow.\nThe successful exploitation of this flaw can result in the immediate termination of the bluetoothd daemon, leading to a Denial of Service (DoS) condition. Furthermore, the nature of the stack-based buffer overflow potentially facilitates arbitrary code execution with the privileges of the bluetoothd process. Given that bluetoothd typically runs with elevated system privileges, this vulnerability poses a severe risk to the confidentiality, integrity, and availability of the affected host system. Exploitation does not require prior authentication or established pairing between the attacker and the victim device, making it a highly dangerous vector for local proximity attacks.",
  "technicalDetails": "The vulnerability is localized within the packet parsing routines of the BlueZ stack responsible for handling Extended Inquiry Response (EIR) data packets. During the Bluetooth device discovery process, the bluetoothd service listens for and processes EIR packets broadcast by nearby devices. The flaw occurs when the input validation mechanisms fail to sufficiently bound the size of incoming EIR data before copying it into a fixed-size stack-allocated buffer.\nThe exploitation flow begins with an attacker acting as a rogue Bluetooth device within radio range of the target. The attacker constructs a malicious EIR packet containing payload data designed to exceed the allocated memory constraints of the destination buffer on the target's stack. When the target device receives this packet and initiates the discovery/parsing routine, the underlying function executes a memory copy operation (such as memcpy or a similar unbounded string/data operation) without performing adequate bounds checking on the length of the provided EIR fields.\nAs the excessive data is written to the stack, it overwrites adjacent memory, including critical control data such as the saved return address or function pointers. By precisely controlling the contents of the overflowed payload, an attacker can hijack the instruction pointer (EIP/RIP) when the affected function attempts to return or execute an overwritten pointer. This control allows the attacker to redirect the execution flow to malicious shellcode injected as part of the EIR packet or to perform return-oriented programming (ROP) to bypass non-executable stack protections.\nBecause the bluetoothd service operates as a privileged system daemon, successful code execution allows an attacker to gain elevated control over the Linux host. The attack is effective even without established pairing or authentication, as the parsing of EIR packets occurs during the discovery phase prior to the establishment of secure Bluetooth links. This minimizes the hurdles for an attacker, who only needs to be in physical proximity and broadcast the crafted frames to the target's radio interface. The crash of the bluetoothd process immediately terminates all active Bluetooth connections and prevents the stack from restarting without manual intervention, effectively disabling all wireless connectivity supported by the service."
}